Analysis Report DHL_document1102202068090891.exe

AV Detection:

Found malware configuration

Source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "933bebd4-0378-4b22-a9fe-1200446be5", "Group": "", "Domain1": "185.157.160.229", "Domain2": "noancore.linkpc.net", "Port": 6700, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Disable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Disable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 29980, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe

ReversingLabs: Detection: 32%

Multi AV Scanner detection for submitted file

Source: DHL_document1102202068090891.exe	Virustotal: Detection: 28%			Perma Link
Source: DHL_document1102202068090891.exe	ReversingLabs: Detection: 32%

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001D.00000002.529223776.0000000002D91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: DHL_document1102202068090891.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 29.2.CasPol.exe.5ae0000.9.unpack

Avira: Label: TR/NanoCore.fadte

Compliance:

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: DHL_document1102202068090891.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\user\Desktop\DHL_document1102202068090891.PDB source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518632539.0000000001601000.00000004.00000020.sdmp, svchost.exe, 00000011.00000002.519615274.00000000012F7000.00000004.00000001.sdmp
Source:	Binary string: .pdb8 source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, AdvancedRun.exe, 0000000C.00000002.330918001.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000000E.00000002.330323781.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb2 source: svchost.exe, 00000011.00000002.516851246.0000000001274000.00000004.00000001.sdmp
Source:	Binary string: DHL_document1102202068090891.PDBp source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.553312759.0000000006F98000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.518675957.00000000012BE000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DHL_document1102202068090891.PDB source: DHL_document1102202068090891.exe, 00000000.00000002.518266676.00000000015E7000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: svchost.exe, 00000011.00000002.518543220.00000000012B1000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb: source: DHL_document1102202068090891.exe, 00000000.00000002.553253133.0000000006F80000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518632539.0000000001601000.00000004.00000020.sdmp
Source:	Binary string: S:AI(RA;IOOICI;;;;WD;("IMAGELOAD",TU,0x0,0x01))\??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 00000011.00000002.516851246.0000000001274000.00000004.00000001.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518564099.00000000015F4000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.553253133.0000000006F80000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.519615274.00000000012F7000.00000004.00000001.sdmp
Source:	Binary string: IL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518833808.0000000001610000.00000004.00000020.sdmp
Source:	Binary string: 00240000048000009400000006020000002400005253413C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: svchost.exe, 00000011.00000002.519520008.00000000012F3000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb1l source: DHL_document1102202068090891.exe, 00000000.00000002.553253133.0000000006F80000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518564099.00000000015F4000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.517829728.00000000015D9000.00000004.00000020.sdmp
Source:	Binary string: kc.pdbis/P} source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\Desktop\DHL_document1102202068090891.PDB/ source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: iLC:\Windows\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb/C:/Windows/System32/cmd.exe source: svchost.exe, 00000011.00000002.519202298.00000000012DF000.00000004.00000001.sdmp
Source:	Binary string: iVisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: 0024000004800000940000000602000000240000525341310004000001000100B5FC90E7027F67871E773A8FDE8938C81DD402Bf:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: svchost.exe, 00000011.00000002.519202298.00000000012DF000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 00000011.00000002.556090022.000000000960D000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbC:\Users\user\Documentsr source: svchost.exe, 00000011.00000002.515773658.0000000001255000.00000004.00000001.sdmp
Source:	Binary string: iVisualBasic.pdbt source: svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: svchost.PDB source: svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.PDB source: svchost.exe, 00000011.00000002.556090022.000000000960D000.00000004.00000001.sdmp
Source:	Binary string: Windows.Foundation.Collections.ValueSet\??\C:\Windows\symbols\dll\mscorlib.pdb source: svchost.exe, 00000011.00000002.519615274.00000000012F7000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.PDB source: svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb} source: DHL_document1102202068090891.exe, 00000000.00000002.553312759.0000000006F98000.00000004.00000001.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noancore.linkpc.net
Source: Malware configuration extractor	URLs: 185.157.160.229

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49732 -> 185.157.160.229:6700

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /base/F55ACED73ADD255559F0ED65FFDFD3E9.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/D9CFC9FB28456A5A139C9F495F1407BB.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/40146EDED8BA63D6AE3F2DAF99B02171.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/F55ACED73ADD255559F0ED65FFDFD3E9.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/D9CFC9FB28456A5A139C9F495F1407BB.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/F55ACED73ADD255559F0ED65FFDFD3E9.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/D9CFC9FB28456A5A139C9F495F1407BB.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/40146EDED8BA63D6AE3F2DAF99B02171.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/40146EDED8BA63D6AE3F2DAF99B02171.html HTTP/1.1Host: coroloboxorozor.com

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 104.21.71.230 104.21.71.230

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /base/F55ACED73ADD255559F0ED65FFDFD3E9.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/D9CFC9FB28456A5A139C9F495F1407BB.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/40146EDED8BA63D6AE3F2DAF99B02171.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/F55ACED73ADD255559F0ED65FFDFD3E9.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/D9CFC9FB28456A5A139C9F495F1407BB.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/F55ACED73ADD255559F0ED65FFDFD3E9.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/D9CFC9FB28456A5A139C9F495F1407BB.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/40146EDED8BA63D6AE3F2DAF99B02171.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/40146EDED8BA63D6AE3F2DAF99B02171.html HTTP/1.1Host: coroloboxorozor.com

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: coroloboxorozor.com

Urls found in memory or binary data

Source: DHL_document1102202068090891.exe, 00000000.00000003.369776362.0000000006F86000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2Assu
Source: DHL_document1102202068090891.exe, 00000000.00000002.522822282.00000000032AB000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.523044419.0000000003141000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com
Source: DHL_document1102202068090891.exe, 00000000.00000002.522226985.0000000003231000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.523044419.0000000003141000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/40146EDED8BA63D6AE3F2DAF99B02171.html
Source: DHL_document1102202068090891.exe, 00000000.00000002.522226985.0000000003231000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/D9CFC9FB28456A5A139C9F495F1407BB.html
Source: DHL_document1102202068090891.exe, 00000000.00000002.522226985.0000000003231000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.523044419.0000000003141000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/F55ACED73ADD255559F0ED65FFDFD3E9.html
Source: powershell.exe, 00000012.00000002.520764725.0000000000C68000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000004.00000002.526127294.00000194BB814000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: DHL_document1102202068090891.exe, 00000000.00000003.369776362.0000000006F86000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: DHL_document1102202068090891.exe, 00000000.00000003.369776362.0000000006F86000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.dig
Source: svchost.exe, 00000004.00000002.526127294.00000194BB814000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: DHL_document1102202068090891.exe, 00000000.00000003.369776362.0000000006F86000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: svchost.exe, 00000004.00000002.526127294.00000194BB814000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000012.00000002.528890375.00000000048B3000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000004.00000002.511485026.00000194B60AF000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2
Source: svchost.exe, 00000004.00000002.511485026.00000194B60AF000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004
Source: svchost.exe, 00000004.00000002.528455496.00000194BBA00000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: DHL_document1102202068090891.exe, 00000000.00000002.522226985.0000000003231000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.523044419.0000000003141000.00000004.00000001.sdmp, powershell.exe, 00000012.00000002.528012031.0000000004771000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000012.00000002.528890375.00000000048B3000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: svchost.exe, 00000007.00000002.305629509.000002278FC13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: powershell.exe, 0000000A.00000003.455029492.0000000009C2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.microsoft.cN
Source: AdvancedRun.exe, AdvancedRun.exe, 0000000E.00000002.330323781.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: svchost.exe, 00000005.00000002.508997125.0000022579443000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000005.00000002.508997125.0000022579443000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000005.00000002.508997125.0000022579443000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000005.00000002.508997125.0000022579443000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000005.00000002.508997125.0000022579443000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000003.305387105.000002278FC49000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000007.00000002.305652333.000002278FC3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000002.305661530.000002278FC4E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000007.00000002.305652333.000002278FC3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000007.00000003.305403663.000002278FC40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000007.00000003.305403663.000002278FC40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000002.305658651.000002278FC4B000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305403663.000002278FC40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
Source: svchost.exe, 00000007.00000003.305387105.000002278FC49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000002.305658651.000002278FC4B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000002.305658651.000002278FC4B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000002.305661530.000002278FC4E000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000007.00000003.305361825.000002278FC5F000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305652333.000002278FC3D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: powershell.exe, 0000000A.00000003.396400202.0000000005CBE000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0C
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: svchost.exe, 00000007.00000002.305652333.000002278FC3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000007.00000002.305652333.000002278FC3D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.305629509.000002278FC13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000003.305400692.000002278FC45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000003.305400692.000002278FC45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000007.00000003.283577676.000002278FC2F000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000007.00000002.305661530.000002278FC4E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: DHL_document1102202068090891.exe, 00000000.00000003.369776362.0000000006F86000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: svchost.exe, 00000011.00000002.513166260.0000000001200000.00000004.00000001.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001D.00000002.529223776.0000000002D91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000001D.00000002.539788145.0000000005370000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.2dfb8c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 29.2.CasPol.exe.5370000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Executable has a suspicious name (potential lure to open the executable)

Source: DHL_document1102202068090891.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL_document1102202068090891.exe

Contains functionality to call native functions

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Code function: 0_2_069D6998 NtSetInformationThread,

0_2_069D6998

Creates files inside the system directory

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_0172C328		0_2_0172C328
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_0172EDE3		0_2_0172EDE3
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_0172EDE8		0_2_0172EDE8
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D0040		0_2_069D0040
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D8D10		0_2_069D8D10
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D9A70		0_2_069D9A70
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D0006		0_2_069D0006
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_06CD0040		0_2_06CD0040
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Code function: 17_2_0566C328		17_2_0566C328
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00918198		18_2_00918198
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00916258		18_2_00916258
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00913318		18_2_00913318
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00914478		18_2_00914478
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00910040		18_2_00910040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00919F58		18_2_00919F58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00E1D220		18_2_00E1D220
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00E1619C		18_2_00E1619C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00E1DD88		18_2_00E1DD88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00E1DD78		18_2_00E1DD78
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Code function: 28_2_0574C328		28_2_0574C328
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Code function: 28_2_0574EB90		28_2_0574EB90

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: String function: 0040B550 appears 50 times

One or more processes crash

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5308 -ip 5308

PE / OLE file has an invalid certificate

Source: DHL_document1102202068090891.exe

Static PE information: invalid certificate

PE file contains strange resources

Source: AdvancedRun.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AdvancedRun.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: DHL_document1102202068090891.exe, 00000000.00000002.542947767.0000000004239000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPeBraba.dll6 vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.520762387.0000000001820000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.504969739.0000000000F00000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameGecvcAeU.exe2 vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.552836368.0000000006CF0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.553111281.0000000006DE0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.553111281.0000000006DE0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp	Binary or memory string: ,@shell32.dllSHGetSpecialFolderPathWshlwapi.dllSHAutoComplete%2.2X%2.2X%2.2X&lt;&gt;&quot;&deg;&amp;<br><font size="%d" color="#%s"><b></b>\StringFileInfo\\VarFileInfo\Translation%4.4X%4.4X040904E4ProductNameFileDescriptionFileVersionProductVersionCompanyNameInternalNameLegalCopyrightOriginalFileNameRSDSu vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAdvancedRun.exe8 vs DHL_document1102202068090891.exe
Source: DHL_document1102202068090891.exe, 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMlZW NWd.exe2 vs DHL_document1102202068090891.exe

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Yara signature match

Source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000001D.00000002.539788145.0000000005370000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.539788145.0000000005370000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.2dfb8c8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 29.2.CasPol.exe.5370000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.5370000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

.NET source code contains calls to encryption/decryption functions

Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Binary contains paths to development resources

Source: svchost.exe, 00000011.00000002.519202298.00000000012DF000.00000004.00000001.sdmp	Binary or memory string: 0024000004800000940000000602000000240000525341310004000001000100B5FC90E7027F67871E773A8FDE8938C81DD402Bf:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb
Source: DHL_document1102202068090891.exe, 00000000.00000002.518564099.00000000015F4000.00000004.00000020.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@44/21@5/5

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 12_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		12_2_00408FC9
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 14_2_00408FC9 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueW,GetProcAddress,AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,		14_2_00408FC9

Contains functionality to enum processes or threads

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_004095FD CreateToolhelp32Snapshot,memset,Process32FirstW,OpenProcess,OpenProcess,OpenProcess,memset,GetModuleHandleW,GetProcAddress,QueryFullProcessImageNameW,CloseHandle,Process32NextW,CloseHandle,

12_2_004095FD

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_0040A33B FindResourceW,SizeofResource,LoadResource,LockResource,

12_2_0040A33B

Contains functionality to modify services (start/stop/modify)

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

12_2_00401306

Creates files inside the user directory

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20210225

Jump to behavior

Creates mutexes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{933bebd4-0378-4b22-a9fe-1200446be50c}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4908:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5308
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6400:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d

Jump to behavior

Launches a second explorer.exe instance

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

PE file has an executable .text section and no other executable section

Source: DHL_document1102202068090891.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Reads ini files

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample is known by Antivirus

Source: DHL_document1102202068090891.exe	Virustotal: Detection: 28%
Source: DHL_document1102202068090891.exe	ReversingLabs: Detection: 32%

Sample reads its own file content

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File read: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\DHL_document1102202068090891.exe 'C:\Users\user\Desktop\DHL_document1102202068090891.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /SpecialRun 4101d8 1864
Source: unknown	Process created: C:\Windows\explorer.exe 'C:\Windows\explorer.exe' 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DHL_document1102202068090891.exe' -Force
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Windows\explorer.exe 'C:\Windows\explorer.exe' 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5308 -ip 5308
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2256
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DHL_document1102202068090891.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /SpecialRun 4101d8 1864			Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5308 -ip 5308
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2256
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: DHL_document1102202068090891.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: DHL_document1102202068090891.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: C:\Users\user\Desktop\DHL_document1102202068090891.PDB source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518632539.0000000001601000.00000004.00000020.sdmp, svchost.exe, 00000011.00000002.519615274.00000000012F7000.00000004.00000001.sdmp
Source:	Binary string: .pdb8 source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: c:\Projects\VS2005\AdvancedRun\Release\AdvancedRun.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.544063484.000000000460D000.00000004.00000001.sdmp, AdvancedRun.exe, 0000000C.00000002.330918001.000000000040C000.00000002.00020000.sdmp, AdvancedRun.exe, 0000000E.00000002.330323781.000000000040C000.00000002.00020000.sdmp, svchost.exe, 00000011.00000002.544010014.0000000004149000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb2 source: svchost.exe, 00000011.00000002.516851246.0000000001274000.00000004.00000001.sdmp
Source:	Binary string: DHL_document1102202068090891.PDBp source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.553312759.0000000006F98000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.518675957.00000000012BE000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DHL_document1102202068090891.PDB source: DHL_document1102202068090891.exe, 00000000.00000002.518266676.00000000015E7000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: svchost.exe, 00000011.00000002.518543220.00000000012B1000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb: source: DHL_document1102202068090891.exe, 00000000.00000002.553253133.0000000006F80000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518632539.0000000001601000.00000004.00000020.sdmp
Source:	Binary string: S:AI(RA;IOOICI;;;;WD;("IMAGELOAD",TU,0x0,0x01))\??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: svchost.exe, 00000011.00000002.516851246.0000000001274000.00000004.00000001.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518564099.00000000015F4000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.553253133.0000000006F80000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.519615274.00000000012F7000.00000004.00000001.sdmp
Source:	Binary string: IL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518833808.0000000001610000.00000004.00000020.sdmp
Source:	Binary string: 00240000048000009400000006020000002400005253413C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: svchost.exe, 00000011.00000002.519520008.00000000012F3000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb1l source: DHL_document1102202068090891.exe, 00000000.00000002.553253133.0000000006F80000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.518564099.00000000015F4000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.517829728.00000000015D9000.00000004.00000020.sdmp
Source:	Binary string: kc.pdbis/P} source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\Desktop\DHL_document1102202068090891.PDB/ source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: iLC:\Windows\Microsoft.VisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb/C:/Windows/System32/cmd.exe source: svchost.exe, 00000011.00000002.519202298.00000000012DF000.00000004.00000001.sdmp
Source:	Binary string: iVisualBasic.pdb source: DHL_document1102202068090891.exe, 00000000.00000002.506062592.00000000012F8000.00000004.00000001.sdmp
Source:	Binary string: 0024000004800000940000000602000000240000525341310004000001000100B5FC90E7027F67871E773A8FDE8938C81DD402Bf:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: svchost.exe, 00000011.00000002.519202298.00000000012DF000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: svchost.exe, 00000011.00000002.556090022.000000000960D000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbC:\Users\user\Documentsr source: svchost.exe, 00000011.00000002.515773658.0000000001255000.00000004.00000001.sdmp
Source:	Binary string: iVisualBasic.pdbt source: svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: svchost.PDB source: svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.PDB source: svchost.exe, 00000011.00000002.556090022.000000000960D000.00000004.00000001.sdmp
Source:	Binary string: Windows.Foundation.Collections.ValueSet\??\C:\Windows\symbols\dll\mscorlib.pdb source: svchost.exe, 00000011.00000002.519615274.00000000012F7000.00000004.00000001.sdmp
Source:	Binary string: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.PDB source: svchost.exe, 00000011.00000002.505795021.0000000000B98000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb} source: DHL_document1102202068090891.exe, 00000000.00000002.553312759.0000000006F98000.00000004.00000001.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Binary contains a suspicious time stamp

Source: initial sample

Static PE information: 0x85456217 [Wed Nov 7 16:00:23 2040 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_0040289F LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_0040289F

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D48D9 push es; retf		0_2_069D48EC
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D48FD push es; retf		0_2_069D4900
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D48F9 push es; retf		0_2_069D48FC
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D48F5 push es; retf		0_2_069D48F8
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D48F1 push es; retf		0_2_069D48F4
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D48ED push es; retf		0_2_069D48F0
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D4911 push es; retf		0_2_069D4914
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D490D push es; retf		0_2_069D4910
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D4909 push es; retf		0_2_069D490C
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D4905 push es; retf		0_2_069D4908
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Code function: 0_2_069D4901 push es; retf		0_2_069D4904
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 12_2_0040B550 push eax; ret		12_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 12_2_0040B550 push eax; ret		12_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 12_2_0040B50D push ecx; ret		12_2_0040B51D
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 14_2_0040B550 push eax; ret		14_2_0040B564
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 14_2_0040B550 push eax; ret		14_2_0040B58C
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Code function: 14_2_0040B50D push ecx; ret		14_2_0040B51D
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Code function: 28_2_05749317 push F000005Eh; retf		28_2_057492F1

.NET source code contains many randomly named methods

Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs

High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Source: 29.2.CasPol.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs

High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Persistence and Installation Behavior:

Drops PE files with benign system names

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\explorer.exe

Executable created and started: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe

Drops PE files

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	File created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe			Jump to dropped file
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	File created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe			Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

File created: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe

Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce LEawmrprcqlukaA

Jump to behavior

Contains functionality to start windows services

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_00401306 OpenServiceW,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,

12_2_00401306

Creates an autostart registry key

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce LEawmrprcqlukaA			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce LEawmrprcqlukaA			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce LEawmrprcqlukaA			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce LEawmrprcqlukaA			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_00408E31 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_00408E31

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains capabilities to detect virtual machines

Source: C:\Windows\explorer.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Contains functionality to detect virtual machines (SGDT)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00E167C0 sgdt fword ptr [eax]

18_2_00E167C0

Contains functionality to detect virtual machines (SIDT)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00E15841 sidt fword ptr [ebp+esi*2-74AAFF1Dh]

18_2_00E15841

Contains functionality to detect virtual machines (SMSW)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 18_2_00E153E1 smsw word ptr [ecx+edi*4-1Dh]

18_2_00E153E1

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5354			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1684			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 4096
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 5281

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 5816	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5140	Thread sleep time: -14757395258967632s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5140	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5000	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5000	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5684	Thread sleep time: -3689348814741908s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WerFault.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: powershell.exe, 0000000A.00000003.494697592.0000000005AA7000.00000004.00000001.sdmp, powershell.exe, 00000012.00000002.538749877.0000000004D4D000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: svchost.exe, 00000004.00000002.527331789.00000194BB84A000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: svchost.exe, 00000005.00000002.528696486.000002257A140000.00000002.00000001.sdmp, svchost.exe, 0000000D.00000002.348855121.000001BD7EF40000.00000002.00000001.sdmp, svchost.exe, 00000015.00000002.359462249.0000021502860000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000011.00000002.516851246.0000000001274000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B-90E5-ECF4BB570DC9}
Source: svchost.exe, 00000011.00000002.519202298.00000000012DF000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001A.00000002.511723717.0000000000928000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\b8b}\
Source: explorer.exe, 00000010.00000002.508304531.0000000000A87000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}`
Source: svchost.exe, 00000004.00000002.527821100.00000194BB860000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000005.00000002.528696486.000002257A140000.00000002.00000001.sdmp, svchost.exe, 0000000D.00000002.348855121.000001BD7EF40000.00000002.00000001.sdmp, svchost.exe, 00000015.00000002.359462249.0000021502860000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000005.00000002.528696486.000002257A140000.00000002.00000001.sdmp, svchost.exe, 0000000D.00000002.348855121.000001BD7EF40000.00000002.00000001.sdmp, svchost.exe, 00000015.00000002.359462249.0000021502860000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000001A.00000002.511723717.0000000000928000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.509681654.0000022579468000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.508922911.0000027B9CC29000.00000004.00000001.sdmp, svchost.exe, 00000011.00000002.516851246.0000000001274000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000A.00000003.494697592.0000000005AA7000.00000004.00000001.sdmp, powershell.exe, 00000012.00000002.538749877.0000000004D4D000.00000004.00000001.sdmp	Binary or memory string: {l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V
Source: svchost.exe, 00000005.00000002.528696486.000002257A140000.00000002.00000001.sdmp, svchost.exe, 0000000D.00000002.348855121.000001BD7EF40000.00000002.00000001.sdmp, svchost.exe, 00000015.00000002.359462249.0000021502860000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000010.00000002.508304531.0000000000A87000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\b8b}\S

Queries a list of all running processes

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Code function: 0_2_069D6998 NtSetInformationThread ?,00000011,?,?,?,?,?,?,?,069D706F,00000000,00000000

0_2_069D6998

Hides threads from debuggers

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Thread information set: HideFromDebugger			Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_0040289F LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_0040289F

Enables debug privileges

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Network Connect: 104.21.71.230 80
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Network Connect: 172.67.172.17 80

Adds a directory exclusion to Windows Defender

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe' -Force
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DHL_document1102202068090891.exe' -Force
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DHL_document1102202068090891.exe' -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 420000			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 422000			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 8BE008			Jump to behavior

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_00401C26 GetCurrentProcessId,memset,memset,_snwprintf,memset,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,GetLastError,

12_2_00401C26

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\DHL_document1102202068090891.exe' -Force			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /SpecialRun 4101d8 1864			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5308 -ip 5308
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2256

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Process created: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe' /EXEFilename 'C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\test.bat' /WindowState ''0'' /PriorityClass ''32'' /CommandLine '' /StartDirectory '' /RunAs 8 /Run			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: DHL_document1102202068090891.exe, 00000000.00000002.521046071.0000000001CB0000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.514691785.0000000001170000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.522047970.0000000001B90000.00000002.00000001.sdmp, explorer.exe, 0000001A.00000002.516337319.0000000001050000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: DHL_document1102202068090891.exe, 00000000.00000002.521046071.0000000001CB0000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.514691785.0000000001170000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.522047970.0000000001B90000.00000002.00000001.sdmp, explorer.exe, 0000001A.00000002.516337319.0000000001050000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: DHL_document1102202068090891.exe, 00000000.00000002.521046071.0000000001CB0000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.514691785.0000000001170000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.522047970.0000000001B90000.00000002.00000001.sdmp, explorer.exe, 0000001A.00000002.516337319.0000000001050000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: DHL_document1102202068090891.exe, 00000000.00000002.521046071.0000000001CB0000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.514691785.0000000001170000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.522047970.0000000001B90000.00000002.00000001.sdmp, explorer.exe, 0000001A.00000002.516337319.0000000001050000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: DHL_document1102202068090891.exe, 00000000.00000002.521046071.0000000001CB0000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.514691785.0000000001170000.00000002.00000001.sdmp, svchost.exe, 00000011.00000002.522047970.0000000001B90000.00000002.00000001.sdmp, explorer.exe, 0000001A.00000002.516337319.0000000001050000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Queries volume information: C:\Users\user\Desktop\DHL_document1102202068090891.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation			Jump to behavior
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Cursors\HbzxlmpZrwoQrExpYSCweYrh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Contains functionality to query windows version

Source: C:\Users\user\AppData\Local\Temp\ca310657-9b53-4e0b-a10e-ddb725ebbc7d\AdvancedRun.exe

Code function: 12_2_0040A272 WriteProcessMemory,GetVersionExW,CreateRemoteThread,

12_2_0040A272

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\DHL_document1102202068090891.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: svchost.exe, 00000009.00000002.512125264.0000015976241000.00000004.00000001.sdmp	Binary or memory string: "@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.512891423.0000015976302000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001D.00000002.529223776.0000000002D91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Source: DHL_document1102202068090891.exe, 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: svchost.exe, 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Source: Yara match	File source: 0000001D.00000002.529223776.0000000002D91000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.504221137.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.533736388.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.543251582.00000000047D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.544943741.000000000430F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.540084949.0000000005AE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.544960546.00000000047D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6560, type: MEMORY
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddb15e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3ddff94.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.3de45bd.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae4629.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4341dc8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.svchost.exe.4806e98.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.CasPol.exe.5ae0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.47d29a0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_document1102202068090891.exe.48057c0.7.raw.unpack, type: UNPACKEDPE